Solidity

Mapping

A mapping is a Solidity key-value storage structure that returns a default value for keys that have never been written.

A mapping is a lookup table, but missing keys look like zero values instead of nonexistent values.

Mapping Explained in Detail

A mapping stores values by key, such as balances by address or roles by account. Mappings do not store a list of keys, and every missing key returns the default value for the value type.

That default behavior is useful, but it can hide whether something was never set or was intentionally set to zero.

Smart contract example

mapping(address => uint256) public balances;
mapping(address => bool) public isAdmin;

For both mappings, a missing key returns 0 or false.

Mapping in Auditing

Mappings often guard balances, allowances, nonces, roles, and claimed airdrops. If mapping updates are wrong, users may gain funds, lose funds, replay signatures, or bypass access control.

Auditors pay special attention to default values and deletion behavior.

Red flags in code

  • Zero means both unset and valid.

  • A mapping is expected to be iterable.

  • Parent structs with nested mappings are deleted with unsafe assumptions.

  • Role mappings are updated without events or admin checks.

  • Nonce or claimed mappings are written after external calls.

How to test or review it

  • Test unset key behavior explicitly.

  • Check every write path for balances, roles, approvals, and nonces.

  • Verify deletion behavior for structs that contain mappings.

  • Use invariants for balance and allowance mappings.

  • Confirm claimed or used mappings are updated before risky external interactions.

Storage Slot

A storage slot is a 32-byte indexed location in EVM contract storage used to hold state variables and derived storage data.

Storage vs Memory vs Calldata

Storage, memory, and calldata are Solidity data locations that decide whether data is persistent state, temporary mutable data, or read-only external input.

Access Control Vulnerability

An access control vulnerability lets an unauthorized caller perform privileged actions such as moving funds, changing roles, upgrading contracts, or changing protocol settings.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Mapping into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources